#formbook
http://bencatty.com/

        url	http://bencatty.com/asda/Project Order.exe
	sha256	8377daf5f454b7d02346f075ce25e22db3b8fef6d17667a6fbadf90401838b74
	sha1	2c94a64868d8887fff04ced3d22abe50a13d9b28
	md5	59fb242cb2befde4f4ed020c6a98dc23
DNS requests
	domain	www.envoyproxy.net
	domain	www.ahmedzaki.info
	domain	www.alexisplay.com
	domain	www.4332222.com
	domain	www.hotgirlshere.com
	domain	www.suagranaonline.com
Connections
	ip	209.200.154.54
	ip	184.168.221.85
	ip	52.6.46.72
HTTP/HTTPS requests
	url	http://www.hotgirlshere.com/hx322/?Lv18=XzU2T858QtA2hL8hxNl2omzz3EaHqVk1xlxcSoITkfnK/ID0pCD7KGeuJWfFSIajihh7YQ==&VPxd=GfmTFTbpsV&sql=1
	url	http://www.ahmedzaki.info/hx322/?Lv18=pOxCy6O4K5V8C1tffSIqiiW6LzOgwc5WmE/fSc/aQr5jFGZXxVLSVF63zNqT4TUVw28toQ==&VPxd=GfmTFTbpsV
	url	http://www.hotgirlshere.com/hx322/
	url	http://www.suagranaonline.com/hx322/?Lv18=CBzORcBN2A9MXph84KQ/AglMx1IeGJI8+pTf3MMTZXpYW0YsAli8/+6nNtpLjiR7fO214Q==&VPxd=GfmTFTbpsV&sql=1
	url	http://www.suagranaonline.com/hx322/

	url	http://bencatty.com/great/PO-926355332.exe
	sha256	907f2bd9c943584638d5792518e45c38775ca78c1c5fa9eadec5b0c5bac9b411
	sha1	447352608bee7f849253f190ffb6a053ae66177b
	md5	5881301df3c2ca1f89517ccf984fad5c
DNS requests
	domain	www.allixanes.com
	domain	www.hydraink.online
Connections
	ip	195.110.124.133
	ip	199.192.22.155
HTTP/HTTPS requests
	url	http://www.allixanes.com/hx322/?ATg4aXl=QT+nQY/xjpvhQvKIEi5RHvjFLXP3aD76t2sCrk8bixAdlIFmdyDAjiDh/ESXmPIOq2kokg==&D8TpK=vDSxV4Kx-27pYL
	url	http://www.hydraink.online/hx322/?ATg4aXl=H5Ae+aF1Yo0xWsbaT0bWL+1an9wh+FBq0+eSSGtHdUShUEYYsAaKKTe/rJAo+r1OLuOc6w==&D8TpK=vDSxV4Kx-27pYL&sql=1
	url	http://www.hydraink.online/hx322/

	url	http://bencatty.com/po/PO-Details.exe
	sha256	c157c7e1c8cb482db3cf87279c3a090d6f421ad8f6ce32cb1587ee822a693ed4
	sha1	5de00231e1c9de267a77df1d89a767559e23f89b
	md5	2ddb9abbc474d72f23574c55bc759c2c
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Temp\sqlite3.dll	16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
DNS requests
	domain	www.yuexingfu.com
	domain	www.plantation-securityshutters.com
	domain	www.jpscy.com
	domain	www.allixanes.com
	domain	www.testmart17.com
Connections
	ip	199.192.22.155
	ip	94.136.40.51
HTTP/HTTPS requests
	url	http://www.allixanes.com/hx322/?9rxHaHT=QT+nQY/xjpvhQvKIEi5RHvjFLXP3aD76t2sCrk8bixAdlIFmdyDAjiDh/ESXmPIOq2kokg==&c8T=uTEDV46Xev70&sql=1
	url	http://www.plantation-securityshutters.com/hx322/?9rxHaHT=QeJNxi1sceWewkVYpRVe469535U66ois8B/zxUnfhTDVLhj44wKzy5KPhDMQLWcs7cwm+g==&c8T=uTEDV46Xev70
	url	http://www.allixanes.com/hx322/